Fix mssense.exe High CPU Usage in Windows (Microsoft Defender for Endpoint)

1. Introduction

mssense.exe is the Microsoft Defender for Endpoint (MDE) Sense service. When it consumes excessive CPU or memory, endpoints lag, scheduled jobs slip, and server SLAs can wobble. This tutorial explains what drives the spike and provides safe, reversible fixes that preserve your protection posture.

2. Quick Triage

1. Restart the service: Press Win+R → services.msc → Microsoft Defender for Endpoint Service → Restart.
2. Run Windows Update: Install pending cumulative, platform, and Defender engine updates.
3. Check if a scan is running: Windows Security → Virus & threat protection → Scan options. High CPU is expected during active scans.
4. Reboot once: Post-update spikes often clear after a restart.

If CPU remains >30–40% for >10 minutes while idle, continue below.

3. Prerequisites

• Local Administrator privileges
• PowerShell (Run as Administrator)
• Access to Microsoft 365 Defender portal for enterprise fleets
• Endpoint connectivity to Microsoft cloud services
• Optional: Sysinternals Process Explorer and Performance Monitor (perfmon.exe)

4. Step-by-Step Guide

Step 1. Verify the binary, location, and signature

1. Open Task Manager → Details, locate mssense.exe.
2. Right-click → Open file location. Legitimate path:

   C:\Program Files\Windows Defender Advanced Threat Protection\

3. Right-click → Properties → Digital Signatures → ensure it’s signed by Microsoft Corporation.

Warning: If the file sits outside the ATP directory or lacks a valid Microsoft signature, treat as suspicious and run a full scan immediately.

Step 2. Check Sense service health

Get-Service Sense | Select-Object Name, Status
Restart-Service Sense -Force
Get-MpComputerStatus | Select AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, NISServiceEnabled

Step 3. Refresh Defender engine, platform, and signatures

# Update definitions
MpCmdRun.exe -SignatureUpdate

# If corruption is suspected, rebuild definitions then update
MpCmdRun.exe -RemoveDefinitions -All
MpCmdRun.exe -SignatureUpdate

# Verify versions
Get-MpComputerStatus | Select AMEngineVersion, AMProductVersion, AntivirusSignatureVersion

Step 4. Right-size scanning with temporary exclusions (for heavy I/O)

For build artifacts, backup targets, or DB data files, consider a temporary exclusion to test impact:

Add-MpPreference -ExclusionPath "C:\Program Files\YourApp"
Add-MpPreference -ExclusionPath "D:\BackupData"

Security note: Only exclude trusted, controlled paths. Remove temporary exclusions after testing.

Step 5. Rebuild the Sense (MDE) component

1. Stop the service:

   sc stop sense

2. Uninstall Sense:

   "%ProgramFiles%\Windows Defender Advanced Threat Protection\SenseCM.exe" -uninstall

3. Re-onboard using your MDE onboarding package from the Microsoft 365 Defender portal.
4. Reboot and validate CPU behavior.

Step 6. Correlate with Performance Monitor

1. Run perfmon.exe → Performance Monitor → Add → Process → % Processor Time → mssense.exe.
2. Optionally add Process → IO Data Bytes/sec and Network Interface → Bytes Total/sec to confirm if load is expected (active scan/telemetry) vs. anomalous.
3. Observe for 10–15 minutes when the system is otherwise idle.

5. Validation and Testing

• Idle CPU: mssense.exe should settle <5% when the system is idle.
• Health check:

  Get-MpComputerStatus

• Functional scan: Run a Quick scan to ensure protection remains intact.
• Persistence: Reboot and confirm stable CPU.

6. Security Hardening

1. Tamper Protection: Windows Security → Virus & threat protection settings → Tamper Protection → On.
2. Attack Surface Reduction (ASR) rules: Prefer behavior blocking to reduce file I/O pressure where appropriate.
3. Centralized policy: Manage exclusions and settings in Microsoft 365 Defender, not locally, for consistency and auditability.
4. Fleet monitoring: Use device performance signals in the Defender portal to spot widespread anomalies early.

7. Conclusion

Most mssense.exe CPU spikes trace back to active scans, outdated/corrupted signatures, or edge-case workloads with heavy file churn. Updating Defender components, validating service health, and—if needed—rebuilding Sense typically resolve the issue without compromising protection.

8. FAQ